Last reviewed: October 2026
No Credit Card Required
A fraud risk assessment asks how someone could steal from the organisation, deceive it, or deceive others on its behalf, and whether the controls in place would stop them. This free fraud risk assessment checklist is for finance directors, heads of internal audit and compliance and risk leads who run the assessment once a year or after a significant change. One run covers one organisation or group. It names the owners and the scope, maps processes, roles and pressures, identifies fraud schemes process by process, rates inherent risk, looks at management override, maps preventive and detective controls and rates residual risk against your tolerance. An action plan phase appears when a scheme is above tolerance. For a UK large organisation in scope of the failure to prevent fraud offence, a further phase checks your procedures against the six principles in the Home Office guidance. The board or audit committee approves the assessment before it is shared, and every action leaves with an owner and a date.
The COSO and ACFE Fraud Risk Management Guide treats fraud as a deliberate act or omission meant to deceive, which causes a loss to the victim or a gain to the person behind it. Intent is what separates fraud from error. It is why the Guide recommends a fraud risk assessment of its own rather than a line in the general risk register: a control that catches honest mistakes may not stop someone who plans the act and hides it.
Most assessments look in one direction, at schemes that take money or assets from the organisation. The failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 looks the other way. It covers fraud by an employee, agent, subsidiary or anyone performing services on the organisation’s behalf, intended to benefit the organisation or its clients. A complete assessment covers both directions and draws on the control reviews and case files that already exist.
Covers: asset misappropriation (false invoices, payroll and expense fraud, theft), corruption (kickbacks, bid rigging, undeclared conflicts of interest) and external fraud such as payment diversion and fake suppliers.
Who commits it: employees, managers, suppliers and outsiders, alone or together.
Where it lands: losses and write-offs, and misstated accounts when it is hidden in the books.
Covers: the fraud offences in Schedule 13 of the Act, such as fraud by false representation, false accounting, fraudulent trading and cheating the public revenue, committed by an associated person to benefit the organisation or its clients.
In scope: large bodies corporate and partnerships (see the table below), since 1 September 2025.
Defence: reasonable fraud prevention procedures in place at the time of the fraud.
Covers: the segregation of duties review, the expense audit, journal entry review and whistleblowing report handling.
Cadence: their own cycles, from every month to every year.
Output: findings and cases that set the likelihood and control ratings in this assessment.
Six phases run in every assessment. Phase 6 appears only for a UK large organisation in scope of the failure to prevent fraud offence, and Phase 7 only when a scheme’s residual risk is above your tolerance.
The answer on the third task decides whether Phase 6 appears. Agree the scales and the tolerance before anyone rates a scheme.
This phase follows the fraud triangle: opportunity, motive and rationalisation. The Home Office guidance suggests building fraud risk typologies from all three.
Work through every category for each process in scope. The first four follow the COSO and ACFE Fraud Risk Management Guide; external fraud and fraud that benefits the organisation complete the picture.
Rate each scheme before counting any control. Management override gets tasks of its own, because the people who set the controls can also step round them.
The answer on the sixth task decides whether Phase 7 appears. Only controls the evidence shows are working count towards residual risk.
Shown only when Phase 1 records that the organisation is, or may be, in scope of the failure to prevent fraud offence. Each task checks one of the six principles in the Home Office guidance against the frauds found in Phase 3. The guidance is advisory and gives no safe harbour, so take legal advice on the gaps.
Shown only when a scheme’s residual risk is above tolerance. Every such scheme leaves this phase with an action plan or a signed acceptance.
The board or audit committee approval holds the rest of this phase until a decision is recorded.
The offence is set out in sections 199 to 206 and Schedule 13 of the Economic Crime and Corporate Transparency Act 2023. The Home Office issued guidance on prevention procedures under section 204; the version read for this page was updated on 10 October 2025. The table summarises both and shows where the checklist covers each point. It is a summary, not legal advice: whether an organisation is in scope and whether its procedures are reasonable are questions for your lawyers and, in the end, for a court.
| Point | What the Act or the guidance says | Covered in |
|---|---|---|
| In force | 1 September 2025, by S.I. 2025/349 | Phase 1 |
| Who can commit it | A body corporate or partnership, wherever incorporated or formed, that is a large organisation (s199(1) and (13)) | Phase 1 |
| Large organisation | Two or more of these in the financial year before the fraud: more than £36 million turnover, more than £18 million balance sheet total, more than 250 employees (s201) | Phase 1 |
| Parent undertakings | The same test on the group’s aggregate figures: more than £36 million net (£43.2 million gross) turnover, more than £18 million net (£21.6 million gross) balance sheet total, more than 250 employees (s202) | Phase 1 |
| Associated person | An employee, agent or subsidiary undertaking of the body, or anyone who otherwise performs services for or on its behalf (s199(7)) | Phases 2 and 6 |
| Fraud offences | Those in Schedule 13, including fraud under section 1 of the Fraud Act 2006, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue, and aiding or abetting any of them (s199(6)) | Phase 3 |
| Intended benefit | The associated person intends to benefit, directly or indirectly, the body or a person they provide services to on its behalf. The body is not liable for a fraud meant to benefit such a client if the body itself was, or was meant to be, its victim (s199(1) and (3)) | Phase 3 |
| Defence | The body had reasonable prevention procedures in place at the time, or it was not reasonable to expect any (s199(4)). The guidance says the body must prove this on the balance of probabilities | Phases 5 and 6 |
| Penalty | A fine (s199(12)) | Not applicable |
| Guidance | Six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training), and monitoring and review | Phase 6 |
| Review | The organisation sets the frequency. The guidance says risk assessments are typically repeated annually or every two years, and a court may find one that has not been reviewed was not fit for purpose | Phase 8 |
The method does not depend on the UK offence. COSO’s 2013 Internal Control – Integrated Framework asks, in Principle 8, that an organisation consider the potential for fraud when it assesses risks to its objectives. The COSO and ACFE Fraud Risk Management Guide (second edition, March 2023) builds a programme on five principles, and its second is the fraud risk assessment: identify specific schemes, rate their likelihood and significance, evaluate the existing controls and act on the residual risk. It names four areas the assessment should address: fraudulent financial reporting, fraudulent non-financial reporting, asset misappropriation, and corruption. The Guide also gives the board the job of assessing the risk of management override, which is why Phase 4 treats override on its own. The ACFE’s fraud risk tools site has the Guide’s executive summary and a fraud risk assessment spreadsheet that works alongside this checklist.
The owners, scope, scoring scales and tolerance sit in the first tasks of every run, so this year’s ratings can be compared with last year’s. A recurring schedule starts the next assessment on its date and assigns it to the assessment lead.
One answer in Phase 1 adds the failure to prevent fraud phase for a UK large organisation, and one answer in Phase 5 adds the action plan when a scheme is above tolerance. An organisation outside the offence gets a shorter checklist, and one with a scheme above tolerance cannot skip the plan.
Board or audit committee approval runs as an approval step that holds the reporting tasks until a decision is recorded, and a scheme kept above tolerance needs its own signed acceptance. Brainstorming notes, control evidence and the report sit on the tasks they support, with a dated record of who did what.
CheckFlow runs the assessment work, the evidence and the approvals. It is not a GRC platform or a fraud analytics tool, and it does not calculate scores: the ratings are your team’s, recorded in the tables on each task. Each run’s progress and overdue tasks show on the Reports Grid. CheckFlow gives no legal advice on the failure to prevent fraud offence.
The assessment relies on control work done elsewhere. The Segregation of Duties Review Checklist finds access conflicts, the Expense Audit Checklist tests paid claims, the Vendor Bank Detail Change Verification Checklist guards against payment diversion and the Whistleblowing Report Handling Checklist takes each concern from receipt to closure. The Operational Risk Assessment Checklist covers the wider risk register, the SOX Internal Control Testing Checklist tests the controls of US-listed companies, and the Procurement Compliance Review Checklist goes deeper on purchasing.
Segregation of Duties Review Checklist
Whistleblowing Report Handling Checklist
Expense Audit Checklist
Operational Risk Assessment Checklist
SOX Internal Control Testing Checklist
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
It is a structured review of how fraud could be committed against or on behalf of an organisation, and whether its controls would prevent or detect it. The assessment identifies specific schemes process by process, rates their likelihood and impact before controls (inherent risk), maps the preventive and detective controls in place, and rates each scheme again after the controls that work (residual risk). Schemes above the organisation’s tolerance get an action plan. The COSO and ACFE Fraud Risk Management Guide makes the assessment its second principle and expects it to be repeated, not done once.
Set the owners, scope and scoring scales first. Then list the processes and the roles with the most opportunity, review pressures and culture, and run brainstorming sessions with each function to identify schemes: asset misappropriation, corruption, financial and non-financial reporting fraud, external fraud and fraud that would benefit the organisation. Rate inherent risk, consider management override separately, map and test the controls, rate residual risk and compare it with your tolerance. Finish with an action plan, a report approved by the board or audit committee, and a date for the next assessment.
It is a corporate offence in section 199 of the Economic Crime and Corporate Transparency Act 2023, in force since 1 September 2025. A large organisation commits it when an associated person, such as an employee, agent or subsidiary, commits one of the fraud offences in Schedule 13 intending to benefit the organisation or certain of its clients. Nobody senior has to have known about the fraud. The defence is that the organisation had reasonable fraud prevention procedures in place at the time, or that it was not reasonable to expect any. The penalty is a fine.
Large bodies corporate and partnerships, wherever they are incorporated or formed. Under section 201, an organisation is large if it met at least two of three conditions in the financial year before the fraud: more than 250 employees, more than £36 million turnover and more than £18 million balance sheet total. For a parent undertaking, section 202 applies the same test to the group’s aggregate figures. The Home Office guidance adds that the fraud must have a UK connection. Take legal advice on how the test applies to your structure.
The Act does not list them. The Home Office guidance, issued under section 204, says an organisation’s procedures should be informed by six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. The guidance is advisory and is not a safe harbour: following it does not guarantee a defence, and departing from it does not rule one out. It also says it will rarely be considered reasonable not to have carried out a risk assessment at all.
The Home Office guidance leaves the frequency to the organisation. It says risk assessments are typically carried out at consistent intervals, annually or once every two years, and that external factors may call for an earlier full or partial review. It warns that a court may find an assessment that has not been reviewed was not fit for purpose. Common triggers for an earlier review are a fraud case, an acquisition, a new product, market or system, a reorganisation or a change in the law.
It is a way of thinking about why fraud happens, built on three elements: opportunity, such as weak controls or little oversight; motive, such as financial stress or targets; and rationalisation, such as believing nobody is harmed. The Home Office guidance suggests that risk owners build fraud risk typologies from all three. Phase 2 of this checklist follows that order: processes and roles for opportunity, pressures and incentives for motive, and culture for rationalisation.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting
